Resource kit
Legal AI buyer's due-diligence checklist
Supplier-neutral due diligence for one defined legal workflow. Use it when a demonstration arrives before the firm has agreed its need or test. This is not procurement, privacy, legal or cyber-security advice.
Operational guidance, not legal advice. No confidential information is needed. Original PDF editions: buyer's guide (v1, 18 Aug 2026) and mid-sized-firm evaluation checklist (v1, 18 Aug 2026) - now combined into this single maintained page.
1. Frame the decision
Write the requirement from the workflow backwards: non-negotiable requirements from one workflow and its owners. A demonstration is not evidence that the firm can operate the product safely.
Specific focus: collect supplier evidence against a frozen requirement, test set and exit route.
Questions to answer:
- What problem is in scope?
- Which data can the supplier access?
- How is quality tested?
- What is the exit route?
Avoid:
- buying because peers are buying
- accepting security claims without evidence
- testing with confidential data before approval
2. Control sheet
Treat a blank evidence field as a reason to pause, not a reason to guess. Record sources and owners before changing the workflow. (The five current numbers come from the Contract-Workflow Baseline Kit, /resources/contract-workflow-baseline-kit/.)
| Area | Evidence to collect | Pass condition |
|---|---|---|
| Need | Workflow and baseline | Owner agrees |
| Data | Retention and subprocessors | Route approved |
| Quality | Test set and errors | Threshold frozen |
| Security | Access, logs and incidents | Owner accepts risk |
| Exit | Export and deletion | Records are retrievable |
Fail closed: if an input, owner or approval is missing, record the gap and keep the affected step outside the proposed change.
3. Working record
Complete this page with counts, dates and named sources. Do not include client names, matter names, contract text or privileged material.
| Field | Evidence or answer |
|---|---|
| Workflow | |
| Current volume | |
| Data categories | |
| Requirements | |
| Pass and stop rule | |
| Exit evidence |
Evidence quality check:
- The source is named and dated.
- An estimate is labelled as an estimate.
- The owner can reproduce the measure.
- The same method can be used after a change.
4. Decision record
Select the outcome that the evidence supports. A stop or no-change decision is valid.
- Stop: a required source, owner or approval is missing.
- Fix: repair the underlying route before adding technology or cost.
- Test: run one bounded change with a baseline and review date.
- Proceed: adopt only the option supported by the recorded evidence.
| Decision field | Record |
|---|---|
| Chosen outcome | |
| Reason and evidence | |
| Owner and approvers | |
| Review or expiry date |
The full question set for supplier data security is at /insights/legal-ai-vendor-data-security-questions/; the evaluation method at /insights/how-to-evaluate-a-legal-ai-tool/; the four-choice decision sheet at /resources/fix-buy-pilot-leave-it-alone-guide/.
Primary sources
- Law Society - Buying new technology: lawsociety.org.uk
- Law Society - How to use lawtech in your practice: lawsociety.org.uk
- ICO - Guidance on AI and data protection: ico.org.uk
- NCSC - Choosing a cloud provider: ncsc.gov.uk
Source status: links checked 15 September 2026 (ICO and NCSC verified live 200; both Law Society pages block automated fetch with 403 but are indexed - confirm by hand before relying). Confirm the current version and obtain appropriate professional advice before relying on regulated, contractual, privacy, security, insurance, financial or wellbeing conclusions.
If you want the due diligence run with you on one workflow, request a 20-minute fit call at /fit-call/.
MARGO LEGAL LTD, company number 17322603. Registered in England and Wales. Registered office: 66 Paul Street, London, England, EC2A 4NA. Originally published as two PDF guides (v1, 18 August 2026); consolidated and converted to HTML 15 September 2026.